Microsoft Intune Connector Guide

Microsoft Intune is a cloud-based endpoint management solution which enables organizations to manage and protect cloud-connected endpoints across Windows, Android, Mac, iOS, and Linux operating systems. The Balbix integration with Microsoft Intune ingests IT infrastructure assets and operating system information discovered by Microsoft Intune.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

Integration Summary

The table below provides information about the integration type, asset types, and data types that are fetched by the Balbix connector for Microsoft Intune.

Prerequisites

To set up your Balbix connector, begin by creating Microsoft Intune API credentials with the required permissions. The Microsoft Graph API supports Microsoft Intune through dedicated APIs and permission roles, leveraging Microsoft Entra for authentication and access control.

Accessing Intune APIs in Microsoft Graph requires:

1. An application ID with the following permissions:

   • Permission to call Azure AD and the Microsoft Graph APIs

   • Permission scopes relevant to the specific application tasks

2. User credentials with the following permissions and roles:

   • Permission to access the Azure AD tenant associated with the application

   • Role permissions required to support the application permission scopes

3. The end user must grant the app permission to perform application tasks within their Azure tenant.

For more information about requirements, refer to How to use Microsoft Entra ID to access the Intune APIs in Microsoft Graph.

Create Microsoft Intune API Credentials and Permissions

Here are the steps you need to complete:

1. Register an App: Set up an application in the Microsoft Entra admin center to integrate your app with the MS identity platform.

2. Add API Permissions: Specify the APIs the app can access.

3. Create an Client Secret: Generate a client secret to authenticate the app with Balbix.

Register an App

Before your app can get access tokens from the Microsoft Identity Platform, it must first be registered in the Microsoft Entra admin center. This registration integrates your app with the Microsoft identity platform and establishes the information needed to obtain tokens.

To create an app registration:

1. Sign in to the Microsoft Intune admin center with administrative credentials. You can use either a tenant admin account or a tenant user account, as long as the "Users can register applications" setting is enabled.

2. Go to All Services and select M365 Microsoft Entra ID > Microsoft Entra ID from the left navigation panel.

3. Click + Add and select App Registration to create a new application or select an existing application. Skip the next step if you are selecting an existing app.

4. Enter the registration information for your application.

   • Name: Balbix

   • Supported account types: Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant)

   • (Optional) Redirect URI: Specify if desired

5. Click Register to create the registration application.

6. On the Overview page, copy the application ID and the directory ID and save them in a safe place to use later when configuring the Balbix connector.

Note: Azure AD Graph API has been retired. For more information, see Update your applications to use Microsoft Authentication Library (MSAL) and Microsoft Graph API.

Add API Permissions

Add API permissions after you have registered the Balbix app:

1. On the Balbix App Registration page, go to Manage > API Permissions then click + Add a permission.

2. On the Request API permissions page, select the Microsoft APIs tab. Search for and select Microsoft Graph.

3. Add permission scopes as follows:

   • Application Permissions

     • Application.Read.All

     • DeviceManagementManagedDevices.Read.All

     • DeviceManagementManagedDevices.ReadWrite.All

Note: Administrator access is required for all Intune permission scopes.

Create a Client Secret

To generate a client secret from Microsoft Intune:

1. Go to Microsoft Entra ID, click App registrations and select the Balbix application.

2. Select Certificates & secrets > Client secrets > New client secret.

3. Add a description for your client secret and select an expiration for the secret or specify a custom lifetime.

4. Click Add.

5. Copy the client secret and save to a safe place for use later when configuring the Microsoft Intune connector in Balbix.

Caution: Be sure to copy and save the client secret—it will no longer be visible after you leave the page.

Create and Configure the Connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for Microsoft Intune.

API Reference Documentation

To learn more about the Microsoft Intune API, see the references listed below:

APIs

• Intune Managed Devices API resource

API Credentials and Permissions

• Microsoft identity platform and OAuth 2.0 authorization code flow

• Authorize access to REST APIs with OAuth 2.0

• Quickstart: Register an application with the Microsoft identity platform

• OAuth 2.0

• Authentication vs. Authorization

• Intune permission scopes

• Microsoft Graph permissions reference